Skip to content

Commit 06b17bf

Browse files
myasnikovdaniilmyasnikovdaniil
authored
ci: move remaining workflows off the persistent self-hosted runner (#3268)
## What this PR does Completes the last step of #2937 — no workflow depends on the persistent self-hosted runner anymore, so it can be decommissioned. PR builds, the main cache warmer, nightly, promote-rc, and pull-requests-release already run on the ephemeral pool; this PR moves the stragglers: - **`tags.yaml` / `prepare-release`** moves to the large ephemeral shape (same as the main cache warmer). Release builds now warm-start from the shared `mode=max` build cache in OCIR (written by `build-main.yaml` on every push to main) while still pushing images to GHCR. Cache manifests are registry-portable, and a missing cache ref degrades harmlessly into a cold build. Without this wiring, every tag build on an ephemeral runner would start 100% cold — the persistent runner used to warm-start from local buildkit state. - **`tags.yaml` / `generate-changelog` and `update-website-docs`**, **`backport.yaml`**, **`update-releasenotes.yaml`** move to GitHub-hosted runners: these jobs only need git and the GitHub API, no docker or repo toolchain. - **`pull-requests.yaml`**: the `debug` label no longer reroutes jobs to the self-hosted runner — that path would queue forever once the runner is gone. The label still gates the SSH breakpoint on e2e failure, which works from ephemeral runners (the breakpoint connects out to the rendezvous server). - **`flux-shard-operator`** was the last image built with the stale inline/`:latest` cache pattern (always cold since #2711); it now uses the shared `cache-args` registry cache like every other image. Operational notes for the actual decommission: - The breakpoint rendezvous server (`BREAKPOINT_ENDPOINT`) is separate infrastructure — if it happens to live on the same host as the runner, it needs a new home before the host is retired. - `tags.yaml` now uses the `OCIR_USER`/`OCIR_TOKEN` secrets on tag events (already used there by `nightly.yaml` and `release-e2e` before it). ### Screenshots Not applicable — CI-only change. ### Release note ```release-note ci: all CI jobs now run on ephemeral or GitHub-hosted runners; release tag builds warm-start from the shared registry build cache ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated multiple GitHub Actions workflows to use more consistent hosted runner environments for checks, PR validation, tagging, backports, and release note updates. * Improved tag/release build setup for ephemeral runners, including optional build toolchain setup and container registry authentication. * Enhanced image build caching for the shard operator to improve packaging efficiency. * **Bug Fixes** * Removed label-driven runner switching in pull request checks to make build and test execution more predictable. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents ca93adc + 814a47f commit 06b17bf

5 files changed

Lines changed: 47 additions & 13 deletions

File tree

‎.github/workflows/backport.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ jobs:
2323
contains(github.event.pull_request.labels.*.name, 'backport-previous') ||
2424
(github.event.action == 'labeled' && (github.event.label.name == 'backport' || github.event.label.name == 'backport-previous'))
2525
)
26-
runs-on: [self-hosted]
26+
# GitHub API calls only — no docker, no repo toolchain: GitHub-hosted.
27+
runs-on: ubuntu-latest
2728
permissions:
2829
contents: read
2930
outputs:
@@ -95,7 +96,8 @@ jobs:
9596
github.event.pull_request.merged == true &&
9697
github.event.pull_request.base.ref == 'main' &&
9798
(needs.prepare.outputs.backport_current == 'true' || needs.prepare.outputs.backport_previous == 'true')
98-
runs-on: [self-hosted]
99+
# git cherry-picks via backport-action — no docker, no repo toolchain: GitHub-hosted.
100+
runs-on: ubuntu-latest
99101
permissions:
100102
contents: write
101103
pull-requests: write

‎.github/workflows/pull-requests.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
# required check rather than blocking e2e from starting.
7171
checks:
7272
name: Unit & controller tests
73-
runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-4cpu-16gb-x86-64' }}
73+
runs-on: oracle-vm-4cpu-16gb-x86-64
7474
timeout-minutes: 30
7575
permissions:
7676
contents: read
@@ -106,7 +106,7 @@ jobs:
106106
needs.plan.outputs.code == 'true'
107107
&& needs.plan.outputs.any == 'true'
108108
&& !contains(github.event.pull_request.labels.*.name, 'release')
109-
runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-4cpu-16gb-x86-64' }}
109+
runs-on: oracle-vm-4cpu-16gb-x86-64
110110
timeout-minutes: 30
111111
permissions:
112112
contents: read
@@ -207,7 +207,7 @@ jobs:
207207
if: |
208208
needs.plan.outputs.code == 'true'
209209
&& !contains(github.event.pull_request.labels.*.name, 'release')
210-
runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-4cpu-16gb-x86-64' }}
210+
runs-on: oracle-vm-4cpu-16gb-x86-64
211211
timeout-minutes: 40
212212
permissions:
213213
contents: read
@@ -290,7 +290,7 @@ jobs:
290290
&& needs.checks.result == 'success'
291291
&& (needs.build.result == 'success' || needs.build.result == 'skipped')
292292
&& needs.build-talos.result == 'success'
293-
runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-4cpu-16gb-x86-64' }}
293+
runs-on: oracle-vm-4cpu-16gb-x86-64
294294
timeout-minutes: 30
295295
permissions:
296296
contents: read
@@ -505,7 +505,7 @@ jobs:
505505
# keeps the guests' 24 vCPU / 72 GiB unchanged (no slower install) while
506506
# leaving 8 vCPU (25%) and 56 GiB of host headroom, which removes the
507507
# oversubscription that starves the probes.
508-
runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-32cpu-128gb-x86-64' }}
508+
runs-on: oracle-vm-32cpu-128gb-x86-64
509509
timeout-minutes: 180
510510
permissions:
511511
contents: read

‎.github/workflows/tags.yaml‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,11 @@ permissions:
1919
jobs:
2020
prepare-release:
2121
name: Prepare Release
22-
runs-on: [self-hosted]
22+
# Ephemeral pool, not the dedicated self-hosted runner (#2937 decommission).
23+
# Serial `make build` + `make assets` is CPU-bound, so use the large shape —
24+
# same as the main cache warmer (build-main.yaml).
25+
runs-on: oracle-vm-24cpu-96gb-x86-64
26+
timeout-minutes: 120
2327
outputs:
2428
# A release (draft or published) already exists for this tag, so the
2529
# build/draft/branch/PR steps are no-ops. Downstream jobs that still need
@@ -135,6 +139,14 @@ jobs:
135139
fetch-depth: 0
136140
fetch-tags: true
137141

142+
# Ephemeral runners lack the flux CLI the installer's image-packages step
143+
# shells out to; install if absent (idempotent).
144+
- name: Set up build toolchain
145+
if: steps.check_release.outputs.release_exists == 'false'
146+
run: |
147+
command -v flux >/dev/null \
148+
|| curl -fsSL https://fluxcd.io/install.sh | sudo bash
149+
138150
- name: Login to GHCR
139151
if: steps.check_release.outputs.release_exists == 'false'
140152
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -145,12 +157,30 @@ jobs:
145157
env:
146158
DOCKER_CONFIG: ${{ runner.temp }}/.docker
147159

160+
# Read-only access to the shared mode=max build cache that build-main.yaml
161+
# writes to OCIR. Release builds push images to GHCR but warm-start from
162+
# that cache — without it every tag build on an ephemeral runner is 100%
163+
# cold (the persistent runner used to warm-start from local buildkit state).
164+
- name: Login to OCIR (build cache)
165+
if: steps.check_release.outputs.release_exists == 'false'
166+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
167+
with:
168+
username: ${{ secrets.OCIR_USER }}
169+
password: ${{ secrets.OCIR_TOKEN }}
170+
registry: iad.ocir.io
171+
env:
172+
DOCKER_CONFIG: ${{ runner.temp }}/.docker
173+
148174
# Build project artifacts
149175
- name: Build
150176
if: steps.check_release.outputs.release_exists == 'false'
151177
run: make build
152178
env:
153179
DOCKER_CONFIG: ${{ runner.temp }}/.docker
180+
# Cache manifests are registry-portable (oci-mediatypes=true) — read
181+
# them from OCIR while pushing images to GHCR. A missing :buildcache
182+
# ref 404s harmlessly into a cold build.
183+
CACHE_REGISTRY: iad.ocir.io/idyksih5sir9/cozystack
154184
# Push the release tag as :IMAGE_TAG (vX.Y.Z-rc.N) and the component
155185
# versions as :<component-ver>. Deliberately NO PUBLISH_FLOATING: this
156186
# job only ever runs for a prerelease (a stable tag is rejected or
@@ -283,7 +313,8 @@ jobs:
283313

284314
generate-changelog:
285315
name: Generate Changelog
286-
runs-on: [self-hosted]
316+
# git + node + copilot CLI only — no docker, no repo toolchain: GitHub-hosted.
317+
runs-on: ubuntu-latest
287318
needs: [prepare-release]
288319
permissions:
289320
contents: write
@@ -492,7 +523,8 @@ jobs:
492523
493524
update-website-docs:
494525
name: Update Website Docs
495-
runs-on: [self-hosted]
526+
# bash + git + yq + gh against the website repo — no docker: GitHub-hosted.
527+
runs-on: ubuntu-latest
496528
needs: [generate-changelog, prepare-release]
497529
# generate-changelog is non-blocking — run as long as prepare-release succeeded.
498530
# `always()` is needed so this job runs even if generate-changelog failed/skipped.

‎.github/workflows/update-releasenotes.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ permissions:
2727
jobs:
2828
update-releasenotes:
2929
name: Update Release Notes
30-
runs-on: [self-hosted]
30+
# GitHub API calls only — no docker, no repo toolchain: GitHub-hosted.
31+
runs-on: ubuntu-latest
3132
permissions:
3233
contents: write
3334

‎packages/system/flux-shard-operator/Makefile‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,7 @@ test:
1414
image-flux-shard-operator:
1515
docker buildx build -f images/flux-shard-operator/Dockerfile ../../.. \
1616
$(call image-tags,flux-shard-operator,v$(COZYSTACK_VERSION)) \
17-
--cache-from type=registry,ref=$(REGISTRY)/flux-shard-operator:latest \
18-
--cache-to type=inline \
17+
$(call cache-args,flux-shard-operator) \
1918
--metadata-file images/flux-shard-operator.json \
2019
$(BUILDX_ARGS)
2120
IMAGE="$(REGISTRY)/flux-shard-operator:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/flux-shard-operator.json -o json -r)" \

0 commit comments

Comments
 (0)